Governance structure and accountability
AI Governance Gap Assessment
Do you have an inventory of the AI in use, a policy people follow, and a named human on each decision?
AI governance is the answer to three questions: what AI is in use here, what rule governs it, and who is accountable when it is wrong. This assessment asks 22 questions across ten domains, weights them for the shape of your organization, and returns a score out of 100 with one of three verdicts. It names no framework, because these are the things every framework assumes you already have.
Two gates can hold the verdict down whatever the score. Three of the controls are preconditions, not contributions, and if any one of them reads zero the verdict is UNGOVERNED at any number, because the rest of the score describes work done on top of something that is not there. And a top verdict cannot sit on a control that reads zero, since a weighted average would otherwise fill the hole in for you. Neither gate can ever improve a verdict. The whole method is published, weights and bands included, so you can recompute the number by hand.
Nothing is fetched from your systems and nothing you type is stored by us: your answers ride inside your own result link. Opening or sharing that link sends the address, and so the answers, to our host the way any URL does, where it appears in ordinary server logs. Nothing in it names you or your company. It is a self-assessment of what you could show today, not an audit, not a certification and not legal advice.
What shape is the organization?
This decides one thing only: whether a control has a surface to exist on. A company with nobody outside the team that builds and uses AI has no independent review to describe, so those questions are dropped rather than scored against you. Nothing else changes, and the smaller shapes are weighted heavier on the basics rather than lighter.
Results are subject to the Terms, which cover how a result may be described to somebody else. Nothing you answer is stored or sent to us.
Common questions
- What is an AI governance gap assessment?
- It is a structured check of whether an organization can answer for the AI it uses: whether there is a list of what is in use, a written rule for using it, and a named human accountable for each decision. This one marks 22 controls across ten domains, weights them for the shape of the organization, and returns a score out of 100 with a verdict of GOVERNED AS DESCRIBED, GAP or UNGOVERNED. It is a self-assessment. It verifies nothing and certifies nothing.
- How is this different from the compliance gap assessment?
- That one is framework-relative: you pick NIST AI RMF, ISO/IEC 42001 or the EU AI Act, and it reports where you fall short of that instrument in that instrument's own vocabulary. This one cites no framework. It measures the substrate all of them assume you already have, which is why it is the more useful of the two when nobody has named a framework yet. If a customer, an auditor or a regulator has already named one, run that one instead.
- Why can a 90 out of 100 still come back UNGOVERNED?
- Because three of the controls are preconditions, not contributions. If there is no list of the AI in use, no written rule, or nobody accountable, then the rest of the score describes work done on top of something that is not there. A vendor register attached to no inventory is a register of the vendors somebody remembered. That gate fires when any one of the three reads zero, at any score, and it can only ever lower a verdict.
- Does the size of the company change the questions?
- It changes which questions have a surface to exist on, and nothing else. A company where nobody is independent of the people building and using AI is not asked whether an independent function reviewed a deployment, because there is no honest answer and scoring it zero would invent a finding. Every other control is asked in full at every size, and the basics carry more weight at the small end, not less, because there is no function there to carry them.
- Does anything I type get sent to you?
- The scoring runs in your browser and nothing is stored. Your answers are encoded into your own result link, so opening or sharing that link sends the address to the host the way any URL does. There is no database, no account and no row connecting a result to a person, which also means the link is the only copy: lose it and the result is gone.
- Is this an audit?
- No. An audit is performed by somebody else, who examines evidence and can disagree with you. This asks you questions and adds up your own answers, none of which it can verify. It is not a certification, not a conformity assessment and not legal advice. What it is good for is finding out what you would have to build before any of those became possible.
The three shapes, briefly
Small team. One person is the whole governance function, alongside their real job. There is no separate compliance, risk, legal or security function, and no standing committee that meets about anything.
Growing. Managers and functions exist. Somebody owns AI governance as part of a wider job, usually operations, security or legal, and reports to someone who has other priorities.
Established. A compliance, risk, legal or security function exists separately from the people building and using AI, and somebody outside the company looks at what you do: a customer's questionnaire, an auditor, a regulator, an insurer.